Written by Matthew Copes
In late November of 1988, a massive Boeing 747-122 operated by United Airlines arrived in San Francisco for nearly a week’s worth of routine maintenance.
Making up the bulk of long-haul fleets around the world, 747s were far and away the largest commercial aircraft of the day, and since being introduced in the early ‘70s they’d collectively wracked up an impressive safety record.
But though they’d serve with distinction well into the 2000s, even back then Boeing engineers and executives, as well as regulators at the Federal Aviation Administration (FAA) knew of at least one potentially fatal defect in the aircraft’s design.
In fact, soon after entering service a troubling trend surfaced.
Gradually at first, locks, motors, switches and latches inside large cargo doors located behind and below 747 cockpits began malfunctioning.
Boeing and the FAA did address some of these issues, but though the latter mandated a number of retrofits to make doors stronger and less prone to blowouts, the deadlines the agency set were liberal to say the least.
United could have taken care of these problems while the aforementioned 747 was being serviced in San Francisco, but the truth was that the FAA deadline was more than a year away, and perhaps more importantly, the aircraft wasn’t making any money parked in a hangar getting new seat covers.
The following year on February 24, 355 passengers and crew members boarded the same plane – registration number N4713U.
Over nearly two decades the aircraft had accumulated nearly 60,000 flight hours with nary a reportable mishap.
Painted in United’s recognizable paint scheme – a white base coat with thick orange, red and blue horizontal stripes running from nose to tail – the aircraft looked newer than it actually was under the high-powered lights on the tarmac at LAX.
Flight 811 was a regularly scheduled United route between Los Angeles and Sydney, Australia, with intermediate stops in Honolulu, Hawaii and Auckland, New Zealand, though on this night the 747 was only about three-quarters full.
The first leg of the flight generally took about 6 hours and 10 minutes to cover the 2,550 miles (4,100 km) between Los Angeles and Honolulu, and only mild turbulence was expected.
After landing in Honolulu a new crew took over, the cabin was tidied and restocked, and the fuel tanks were topped off in preparation for the 9.5-hour, 4,400-mile trip to New Zealand.
But though the taxi, takeoff and climb to altitude were all uneventful, less than 30 minutes into the flight the 747 experienced a jarring explosion akin to a bomb going off inside the cargo hold.
The plane would ultimately land safely back at Honolulu International Airport, but with a huge hole torn in its fuselage and nine passengers gone forever.
Nearly 200 feet (61 m) between wingtips, 250 feet (76 m) long from nose to tail and tipping the scales at about 800,000 pounds (362,900 kg), 747s are truly big airplanes.
Capable of carrying 48,000 US gallons (218,000 L) of fuel to power four turbofan engines producing about 50,000 pounds of thrust each, depending on variant, 747s are capable of cruising at approximately 550 miles per hour (900 km/h) for more than 6,100 miles (9,800 kilometers).
After stopping in Honolulu, the aircraft was handed off to 59-year-old Captain David Cronin, a man with 30,000 flight hours under his belt – more than 1,500 of which were in 747s.
Ironically, Flight 811 was to be Cronin’s next to last flight before mandatory retirement.
In addition to more than a dozen flight attendants, the cockpit crew was rounded out by First Officer Gregory Slader and Flight Engineer Randal Thomas, both of whom had accumulated more than 15,000 of flying time over the years.
At 1:52 AM local time, Flight 811 took off from Honolulu International Airport without incident, after which the captain began detouring around a large storm that lay directly in their path.
Though large and ominous, the storm wasn’t anything out of the ordinary, and again only moderate turbulence was expected, though to play it safe the captain ordered that all passengers remain in their seats with their seatbelts fastened.
Less than 20 minutes into the flight, the altimeter showed that the 747 had passed 22,000 feet (6,700 m) when the cabin and cockpit were rocked by a resounding thump and a hair-raising shudder, both of which were unlike anything anyone on board had ever experienced.
To the terrified passengers, pilots and crew, the incident had all the hallmarks of a bombing.
After all, this was just two months after the Pan Am Flight 103 disaster over Lockerbie, Scotland.
But unbeknownst to the occupants, the thump and explosion-like sound that had rocked the jumbo jet hadn’t been caused by a bomb, but by the 9-foot by 9-foot (2.7 m x 2.7 m) 800-pound (360 kg) cargo door behind the cockpit slamming open, breaking its hinges and crashing through the fuselage before ultimately sheering off, slamming into the starboard wing’s leading edge and falling into the abyss below.
The 747s immense forward cargo doors had been designed with mechanical stops to prevent them from opening during flight.
However, this particular incident was caused by an unlikely chain of events that might have been avoided altogether if the mandated FAA retrofits had been taken care of sooner rather than later.
Now with a gaping hole in the fuselage the cabin experienced an immediate loss of pressure as air rushed out, the force of which was so great that it caused the upper deck to collapse.
Worse yet, ten seats containing eight passengers were immediately ripped free and sucked through the enormous hole.
None of those ejected from the aircraft would survive, nor would their bodies ever be recovered.
Surviving passengers and flight attendants later reported surreal scenes, especially immediately after the incident.
Senior flight attendant Laura Brentlinger was nearly expelled from the aircraft in the massive pressure equalization, but she somehow managed to grab and hold onto the stairs leading to the upper deck.
Despite the risks, passengers and crew scrambled to pull her back to the relative safety of the cabin, though she sustained serious injuries and was nearly unconscious.
Survivors on the port side of the aircraft reported looking across the cabin and seeing fellow passengers strapped in their seats just meters from the gaping hole.
Though some were frantic, others sat perfectly still – in shock, eyes wide open, while the deafening wind roared by and the two starboard engines sputtered, hissed, and emitted flames as if they too were about to explode.
Meanwhile in the cockpit, the captain and officers were unsure what had happened, how extensive the damage was, and if the aircraft was even flyable.
What they did know was that the emergency oxygen system had been damaged, which meant that their first priority was to make an emergency descent to get the plane to an altitude at which the air was breathable.
Captain Cronin immediately initiated a sweeping 180° left turn back toward Honolulu, but debris from the door and fuselage had damaged the wing and both the vertical and horizontal stabilizers on the tail, and the two starboard engines were vibrating badly, losing power and emitting flames.
At 2:20 AM an emergency was declared and the crew began dumping fuel to reduce landing weight and decrease the likelihood of fires and explosions.
In addition, both starboard engines were shut down.
Since he wasn’t sure if the landing gear had been damaged during the explosion, Captain Cronin attempted to notify the cabin crew that an emergency landing was likely, but he was unable to contact them through the intercom.
The Captain ordered Flight engineer Thomas to go and relay the message in person, and the damage he saw immediately after leaving the cockpit was even worse than he’d expected.
In addition to the missing portion of the fuselage, the 747’s aluminum skin was curled back, severed frame members, insulation and cut wires vibrated in the wind, and a number of seats that’d once been in an orderly row were conspicuously absent.
Thomas returned to the cockpit and reported what he’d seen, and everyone agreed that the damage had probably been caused by a bomb.
In light of damage to the control surfaces and the loss of the starboard engines, the 747 would need to land at a much faster clip than was normal because one of its wings wasn’t creating as much lift as it should have been.
In other words, the 800,000-pound leviathan would have to fly faster to create the lift necessary to stay aloft until its wheels touched down on solid ground.
Thankfully, as the crippled airliner neared the airport the landing gear extended normally, but the flaps used to slow descent weren’t working.
Touching down at approximately 220 miles per hour (355 km/h) instead of the normal 165 miles per hour (265 km/h), with the help of the thrust-reversers on the two operable engines, Captain Cronin was able to bring the aircraft to a halt just before the end of the runway.
By the time the plane came to a stop, less than 15 minutes had elapsed since the emergency was declared, and less than a minute later all passengers and flight attendants had been evacuated using the large, built-in inflatable ramps.
Despite extensive air and sea searches, no remains of the nine lost passengers were ever found, though in a particularly grizzly turn of events, small pieces of bone, flesh and clothing were found in the fan blades and compressor of at least one of the jet engines.
National Transportation Safety Board Investigation
The National Transportation Safety Board (NTSB) immediately opened an investigation to determine what had caused the catastrophic door failure that had led to nine deaths.
But though much could be determined from the aircraft and the eyewitness accounts of survivors, what the NTSB really needed was the missing door.
The problem was that it’d disappeared somewhere over the Pacific.
Based on the vastness of the ocean and the depth of the water in which it came to rest, finding it would be like the old needle in the haystack analogy.
Unsurprisingly, despite tireless searching the door wasn’t found and the NTSB was forced to proceed with its investigation and hope that it would turn up later.
The board considered the circumstances in which the event occurred, prior reports of problems involving 747 cargo doors, and findings from a similar incident on Pan Am Flight 125 in 1987, in which a 747 experienced a rapid loss of pressure at the same altitude after departing from London Heathrow Airport.
Unlike United 811, Pan Am Flight 125 returned safely to Heathrow with relatively minor damage without loss of life, but the circumstances were remarkably similar.
With Flight 125 the cargo door hadn’t blown off, but it was found to be open nearly two inches, though still technically latched shut.
Further examination revealed that the locking arms that were supposed to secure the door to the aircraft’s frame were either damaged or inoperable.
As is often the case, Boeing quickly and perhaps even suspiciously attributed this to rough handling and operational errors by inexperienced or careless ground crews, as opposed to inherent flaws in the aircraft itself.
Inside 747 cargo doors, a series of aluminum arms known as locking sectors are actuated and held in place by rotating cams that are activated after the doors have been closed and secured prior to departure.
It’s important to note that when in the locked position, the power supply to the electric motor that operated the cams should have been disconnected.
This safeguard was meant to ensure that a malfunction would not cause the motor to retract the locking arms while in flight or during takeoffs and landings.
However, in some instances the safety switches didn’t work, and the motors could draw power.
There were additional mechanical locks to ensure that the cams couldn’t be turned even in rare cases like these, but the strain on the relatively weak aluminum locking sectors could eventually cause them to fracture or snap if pressure was applied long enough.
But despite the mounting evidence, Boeing engineers weren’t convinced that this was even possible.
To see if it was, the company instructed various airlines that operated 747s to close and lock cargo doors from the outside, then to manually activate the door-open switch with the handle still in the locked position.
With the handle locked and the switches disconnected, nothing should have happened, but some customers reported that the motors did hum to life and apply pressure to both the cams and locking sectors.
Now it was becoming increasingly clear that the door mechanisms weren’t working as they’d been designed to, but the NTSB determined that it wasn’t an imminent safety issue since malfunctioning motors couldn’t cause the doors to open.
But what neither the NTSB nor Boeing knew then, was that the motors were powerful enough to cause significant internal damage inside the doors, out of view of cabin and maintenance crews and inspectors.
In fact, it was later determined that there were at least two scenarios in which cargo doors could open mid-flight.
The first was when internal door components broke, and the second when doors hadn’t been properly latched in the first place, even though by all outward appearances they had been.
During its investigation the NTSB found that in the case of Flight 811, the aircraft had experienced intermittent cargo door malfunctions in the months leading up to the incident.
Based on this information, the board concluded in its April 1990 final report that these malfunctions had damaged the locking mechanism in such a way that it appeared to the ground crew as though the door was adequately locked and latched, though in reality it wasn’t.
In other words, according to the NTSB, the accident was largely the result of human error on the part of the ground crew.
To some however, this finding was glaringly inadequate.
Not only did it brush aside the evidence of poor design and previous door issues, but it seemed to show an all too cozy relationship between the NTSB and the manufacturers and airlines it was tasked with regulating.
Had 24-year-old New Zealander Lee Campbell not been among the nine casualties that fateful night in 1988, the NTSB’s findings may have closed the book on Flight 811 forever.
But after Lee’s death his parents conducted their own unofficial investigation, largely because they were unconvinced that American regulators had done a thorough job.
After obtaining and painstakingly reviewing piles of documents from the original NTSB investigation, the Campbells concluded that the cause of the accident hadn’t been human error at all.
Instead, they argued that the real problem stemmed from electrical issues, inherent flaws in the cargo door’s latching mechanism, and the fact that the door opened outward instead of inward.
Inward opening “plug” doors are far stronger and safer than their outward opening counterparts, and it’s almost impossible for them to blow open under any conditions.
On the downside, they’re unpopular with aircraft operators because they take up valuable interior space that can be used to accommodate revenue generating passengers and freight.
On the contrary, outward opening doors take up no interior space.
However, they require strong locking mechanisms to keep them closed, and when malfunctions occur they’re far more prone to accidental openings.
Sadly, this wasn’t exactly front page news, because the deficiencies of outward opening doors were well-known, and they were present on other wide body aircraft like the McDonnell Douglas DC-10.
But despite previous incidents, these problems were never fully addressed by Boeing, the airlines or aviation regulators.
It was also later discovered that as many as a dozen years before the Flight 811 incident, Boeing and the airlines knew that the aluminum locking sectors weren’t strong enough to do the job for which they’d been built.
To nip the potential safety issue in the bud, Boeing had even recommended that operators add additional aluminum locking sectors, or replace the originals with stronger steel units.
Whatever the airlines did or did not decide to do, visually inspecting interior door mechanisms regularly was now of the utmost importance.
The FAA issued an airworthiness directive in July of 1988 – less than five months before Flight 811 took off from Honolulu – but it gave US-based airlines between 18 and 24 months to comply.
Considering the potential safety hazards and the relative ease of repairs necessary to fix the issues, it was a ridiculously lax deadline.
Tellingly, the FAA shortened compliance time to just one month after the Flight 811 accident.
Then miraculously, in the fall of 1990 two distinct halves of Flight 811’s cargo door – which had been sheared in two – were recovered on the seabed 14,000 feet (4,200 m) below the surface of the Pacific Ocean not far from the Hawaiian coast.
The NTSB had little choice but to reopen its investigation and inspect the cargo door, after which it determined that the state of the locking mechanisms were almost certainly to blame for the accident, and not human error as was originally claimed.
Then in 1991 another similar but non-catastrophic incident occurred just after yet another Boeing 747 departed from New York’s John F. Kennedy Airport.
Again, malfunctioning cargo door motors, cams and locking sectors were to blame.
Faced with irrefutable proof based on its own inspection of Flight 811’s door and new information provided by the Campbells, the NTSB issued a new and final report in the spring of 1992.
In it, the board reiterated that the accident that took nine lives was most likely attributable to numerous deficiencies in the door’s design.
In short, it appeared as though the electric motors that should have been disconnected from the power source began to exert forces on the relatively weak cams and locking sectors, and that in less than 20 minutes they’d caused distortions and hairline fractures which eventually weakened them sufficiently to allow the door to blow off.
As a sub-recommendation, the NTSB “suggested” that all airlines replace outward opening doors with inward opening plug-style doors, though 747 operators weren’t mandated to do so.
The year after the incident the flight crew received the Secretary’s Award for Heroism from the US Department of State.
Despite extensive structural damage, 747 number N4724U was repaired, repainted and quietly returned to United service in 1990.
Nearing the end of its service life seven years later, the aircraft was sold to now-defunct Gambian airline Air Dabia, and just a few years later it was abandoned at Plattsburgh International Airport in upstate New York.
In 2004 the old 747 was scrapped for spare parts.
These days inward opening plug doors are standard on most airliners, especially for the small doors through which passengers enter and exit the aircraft.
However, cargo doors on many aircraft still open outward to optimize space utilization, so at least in that respect, economics, not safety, is the guiding principle in commercial aviation.